CVE-2023-53222 jfs: jfs_dmap: Validate db_l2nbperpage while mounting
An attacker can cause a kernel crash by mounting a crafted JFS filesystem with an invalid block size value, leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-53222?
CVE-2023-53222 is a high-severity vulnerability in Linux kernel, published on 15 Sep 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
jfs: jfs_dmap: Validate db_l2nbperpage while mounting
In jfs_dmap.c at line 381, BLKTODMAP is used to get a logical block number inside dbFree(). db_l2nbperpage, which is the log2 number of blocks per page, is passed as an argument to BLKTODMAP which uses it for shifting.
Syzbot reported a shift out-of-bounds crash because db_l2nbperpage is too big. This happens because the large value is set without any validation in dbMount() at line 181.
Thus, make sure that db_l2nbperpage is correct while mounting.
Max number of blocks per page = Page size / Min block size => log2(Max num_block per page) = log2(Page size / Min block size) = log2(Page size) - log2(Min block size)
=> Max db_l2nbperpage = L2PSIZE - L2MINBLOCKSIZE
Weakness: CWE-125
Which versions are affected by CVE-2023-53222?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2023-53222?
Apply the vendor's patch.
Is CVE-2023-53222 being exploited?
There is no known exploitation of CVE-2023-53222 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2023-53222, DEBIAN-CVE-2023-53222, GHSA-3277-7c79-2vxw, UBUNTU-CVE-2023-53222.